CVE-2026-62250
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decode_preR13_entities() in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decode_preR13 in src/decode_r11.c computes size from the raw file-controlled entities_start and entities_end header bounds; the callee clamps end to dat->size but never recalculates size. At end of input, bit_read_RC and bit_read_RS stop advancing dat->byte, the overflow guard fails, and the no-advance check compares against oldpos saved before the loop. This leaves repeated allocation of dwg->object entries until allocation fails or the process is OOM-killed. The defect is fixed in version 0.14.8413.
Risk Assessment
Applications and tools such as dwg2dxf, dwgread, and dwg2svg calling dwg_read_file() on untrusted files can suffer denial of service when a user or automated pipeline opens a malicious file. No attacker credentials are required.
Recommendation
Update LibreDWG to version 0.14.8413 or later. Until updated, process untrusted DWG files in an environment with memory and time limits.
Other vulnerabilities in LibreDWG
See all- CVE-2026-62254Medium
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in decode_R13_R2000 in src/decode.c. The class-decoding loop performs realloc on every iteration without a sanity check on num_classes; manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.
- CVE-2026-54610Low
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const input. On an `iconv()` error other than `E2BIG`, the function frees its output buffer and passes the original input alias to `bit_u_expand()`, which can cause a segmentation fault and denial of service or unexpected modification of mutable input.
- CVE-2023-36274High
LibreDWG versions 0.11 to 0.12.5 were found to contain a heap buffer overflow in the function bit_write_TF in bits.c.
- CVE-2023-36273High
Version 0.12.5 of LibreDWG was found to contain a heap buffer overflow vulnerability in the function bit_calc_CRC in bits.c.
- CVE-2023-36272High
Versions of LibreDWG from 0.10 to 0.12.5 were found to contain a heap buffer overflow vulnerability in the function bit_utf8_to_TU in bits.c.
- CVE-2023-36271High
LibreDWG versions 0.10 to 0.12.5 were found to contain a heap buffer overflow in the function bit_wcs2nlen at bits.c.
Original NVD description (English source)
LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating loop that allocates a new object each iteration. `decode_preR13` in `src/decode_r11.c` computes `size` from the raw file-controlled `entities_start` and `entities_end` header bounds; the callee clamps `end` to `dat->size` but never recalculates `size`. At `end` of input, `bit_read_RC` and `bit_read_RS` stop advancing `dat->byte`, the overflow guard fails because `end` equals `dat->size`, and the no-advance check compares against `oldpos` saved before the loop instead of the previous iteration. This leaves repeated allocation of `dwg->object` entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling `dwg_read_file()` on untrusted files, including `dwg2dxf`, `dwgread` and `dwg2svg`, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS